Operator commands

These commands run the public server and manage its tokens. They are hidden from the default routeup --help because normal users never need them. Everything here is for the operator of a deployment, see Self-hosting for the full guide.

Run the server

CLOUDFLARE_API_TOKEN=… \
  routeup server --domain tunnel.example.com --reserved edge \
  --db /var/lib/routeup/server.db

Key flags:

--domain <suffix>           public suffix, e.g. tunnel.example.com
--config <path>             server config file
--db <path>                 SQLite database path
--public-namespace <label>  enable a token-less namespace
--reserved <label>          reserve a root-tier label; repeatable
--tls-mode <acme|cert>      acme auto-issues wildcards; cert uses your files
--tls-cert <path>           PEM certificate for cert mode
--tls-key <path>            PEM private key for cert mode

Run routeup server --help for listen, ACME, logging, metrics, and rate-limit options.

In acme mode the server obtains and renews wildcard certificates through Let’s Encrypt using the Cloudflare DNS-01 challenge (CLOUDFLARE_API_TOKEN). In cert mode you provide a certificate and key. See TLS.

Manage tokens

Tokens authorize persistent, scoped public claims. Mint them out-of-band and hand the secret to the client privately.

routeup token create mukul --allow "*.tunnel.example.com" --db /var/lib/routeup/server.db
routeup token create alice --allow "*.alice.tunnel.example.com" --db /var/lib/routeup/server.db
routeup token list --db /var/lib/routeup/server.db
routeup token revoke <token-id> --db /var/lib/routeup/server.db

Run token commands on the server host. They open SQLite directly, so use the same --db or --config value as the running server.

The allow pattern is the only authority; the server rejects any claim whose host falls outside it. Tiers fall out of the pattern shape:

*.tunnel.example.com          # root tier; one label under the suffix
*.alice.tunnel.example.com    # a personal namespace
*.team-x.tunnel.example.com   # a shared team namespace

Token secrets use the sk_routeup_ prefix, are shown once at creation, and are stored only as a SHA-256 hash. See Minting tokens.